Implement durable typed journals, subscriptions, and Reader document connections

Add checked native journal/subscription bindings, managed-reference retention,
bounded history and backpressure, atomic delivery receipts, and fenced hosting.
Preserve source publication prediction and replica reconciliation; subscription
attachment, controls, and delivery remain authoritative in this initial version.

Connect independent manual/Gutenberg document producers to Reader bookshelves
through typed adapters. Add connection inspection, shared provider selection,
authoring documentation, and restart/rejection/fan-out integration coverage.

Verified compiler suite (287 passed, two existing skips), Nix runtime and
PostgreSQL qualification, five example assemblies, headless Reader integration,
Chromium Reader integration, resource pins, formatting, and lint.
No pinned workspace runtime was deployed.

src/capability-model/evolution.ts

@@ -196,6 +196,10 @@ export const runtimeContracts = (workspace: WorkspaceRevision): RuntimeContract[
   };
   const binding = (parent: GraphNode, value: Binding, atomId: string, context: unknown) => {
     if (value.kind === "lifecycle") return;
+    if (value.kind === "journal" || value.kind === "subscription") {
+      dependency(parent, { kind: "state", slotId: value.slotId }, atomId);
+      return;
+    }
     if (value.kind !== "package") {
       dependency(parent, value, atomId);
       return;

src/capability-model/execution.ts

@@ -25,6 +25,7 @@ export function validateExecutionContracts(workspace: WorkspaceRevision): Capabi
     requested: ExecutionContract | undefined,
     provided: ExecutionContract | undefined,
     path: string,
+    requireTargets = true,
   ) => {
     if (!requested || requested.kind === "remote") return;
     if (!provided || provided.kind === "remote") {
@@ -33,8 +34,9 @@ export function validateExecutionContracts(workspace: WorkspaceRevision): Capabi
     }
     if (requested.kind === "snapshot" && provided.kind !== "snapshot")
       fail(path, "Snapshot execution cannot perform a transaction");
-    for (const target of requested.targets ?? [])
-      if (!provided.targets?.includes(target)) fail(path, `Dependency does not provide execution target ${target}`);
+    if (requireTargets)
+      for (const target of requested.targets ?? [])
+        if (!provided.targets?.includes(target)) fail(path, `Dependency does not provide execution target ${target}`);
   };
   for (const revision of workspace.interfaceImports)
     for (const member of revision.template?.members ?? revision.members) {
@@ -82,7 +84,10 @@ export function validateExecutionContracts(workspace: WorkspaceRevision): Capabi
           if (entry.execution && entry.execution.kind !== "remote") {
             if (!selected) fail(portPath, "Portable interface ports must select their required operations");
             for (const id of selected ?? [])
-              if (contract) supports(entry.execution, operations(id, contract)?.execution, portPath);
+              // Package targets describe available code. Required public target
+              // guarantees are checked over the installed operation closure;
+              // an optional implementation target must not strengthen a dependency.
+              if (contract) supports(entry.execution, operations(id, contract)?.execution, portPath, false);
           }
         }
         if (!entry.execution || entry.execution.kind === "remote") continue;
@@ -150,6 +155,20 @@ export function validateExecutionContracts(workspace: WorkspaceRevision): Capabi
         continue;
       }
       if (!operation.execution || operation.execution.kind === "remote") continue;
+      if (binding.kind === "journal") {
+        const expected = binding.primitive === "publish" ? "transaction" : "snapshot";
+        if (operation.execution.kind !== expected) fail(path, "Native journal operation requires the matching effect");
+        continue;
+      }
+      if (binding.kind === "subscription") {
+        const expected = binding.primitive === "status" ? "snapshot" : "transaction";
+        if (
+          operation.execution.kind !== expected ||
+          (binding.primitive !== "status" && operation.execution.targets.some((target) => target !== "server"))
+        )
+          fail(path, "Subscription controls require authoritative execution; status is a portable snapshot");
+        continue;
+      }
       if (binding.kind === "package") {
         const provider = packages.get(binding.packageRevisionId)?.exports.find((e) => e.id === binding.exportId);
         supports(operation.execution, provider?.execution, path);

src/capability-model/initialization.ts

@@ -24,7 +24,13 @@ export function validateInitialization(workspace: WorkspaceRevision): Capability
       fail(ownerKey(owner), `Initialization input ${field.input} must name an attachment owned by this conformance`);
       return;
     }
-    if (attachment.kind === "state") return attachment.valueType;
+    if (attachment.kind === "state") {
+      if (["journal", "subscription"].includes(attachment.storagePolicy.kind)) {
+        fail(ownerKey(owner), "Native journals start empty and cannot be seeded as state");
+        return;
+      }
+      return attachment.valueType;
+    }
     if (binding.kind !== "edge") return;
     const index = attachment.endpoints.findIndex((e) => e.projectionId === binding.projectionId);
     const endpoint = attachment.endpoints[index];
@@ -102,7 +108,12 @@ export function validateInitialization(workspace: WorkspaceRevision): Capability
         ...workspace.conformances.flatMap((o) => o.privateAttachments),
       ].filter((a) => a.kind === "state" && a.attachedTo === binding.atomId);
       for (const state of states)
-        if (state.kind === "state" && state.defaultValue === undefined && !initialized.has(state.id))
+        if (
+          state.kind === "state" &&
+          !["journal", "subscription"].includes(state.storagePolicy.kind) &&
+          state.defaultValue === undefined &&
+          !initialized.has(state.id)
+        )
           fail(portPath, `Required state ${state.id} has no default or declared seed mapping`);
     }
   };

src/capability-model/journals.ts

@@ -0,0 +1,131 @@
+import {
+  valueType,
+  type JournalPrimitive,
+  type InterfaceOperation,
+  type InterfaceRevision,
+  type ObjectExpectation,
+  type OperationId,
+  type ValueType,
+} from "./types.js";
+import { valueTypesEqual } from "./validation.js";
+
+export const subscriptionStatusType: ValueType = {
+  kind: "record",
+  fields: {
+    status: valueType.string,
+    generation: valueType.uint64,
+    cursor: valueType.uint64,
+    failure: {
+      kind: "optional",
+      value: {
+        kind: "record",
+        fields: { publication: valueType.string, code: valueType.string, message: valueType.string },
+      },
+    },
+  },
+};
+
+/** Native subscription configuration is selected by the checked attach contract.
+ * No library/interface ID or handler method name is reserved by Camino. */
+export function subscriptionContract(
+  payload: ValueType,
+  parameters: ValueType,
+  attach: InterfaceOperation,
+  interfaces: readonly InterfaceRevision[],
+): { source: ObjectExpectation; handler: ObjectExpectation; operation: OperationId } {
+  const fail = (message: string): never => {
+    throw new Error(message);
+  };
+  if (
+    attach.mode !== "call" ||
+    attach.scope === "class" ||
+    !valueTypesEqual(attach.outputType, valueType.unit) ||
+    attach.inputType.kind !== "record"
+  )
+    return fail("Subscription attachment must be an object call returning unit");
+  const fields = attach.inputType.fields;
+  if (
+    Object.keys(fields).sort().join(",") !== "handler,parameters,source,start" ||
+    fields.source?.kind !== "object-ref" ||
+    fields.handler?.kind !== "object-ref" ||
+    fields.handler.expectation.kind !== "interface" ||
+    !valueTypesEqual(fields.parameters!, parameters)
+  )
+    return fail("Attachment needs typed source/handler references, matching parameters, and a start policy");
+  const start = fields.start;
+  if (
+    start?.kind !== "variant" ||
+    Object.keys(start.cases).sort().join(",") !== "afterCursor,future,retained" ||
+    !valueTypesEqual(start.cases.future!.value, valueType.unit) ||
+    !valueTypesEqual(start.cases.retained!.value, valueType.unit) ||
+    !valueTypesEqual(start.cases.afterCursor!.value, valueType.string)
+  )
+    return fail("Subscription start requires future:unit, retained:unit and afterCursor:string variant cases");
+  const handler = fields.handler.expectation;
+  const expected: ValueType = { kind: "record", fields: { event: payload, parameters } };
+  const candidates =
+    interfaces
+      .find((iface) => iface.revisionId === handler.interfaceRevisionId)
+      ?.members.flatMap((member) => member.operations)
+      .filter(
+        (operation) =>
+          operation.mode === "call" &&
+          operation.scope !== "class" &&
+          operation.execution?.kind === "transaction" &&
+          operation.execution.targets.includes("server") &&
+          valueTypesEqual(operation.inputType, expected) &&
+          valueTypesEqual(operation.outputType, valueType.unit),
+      ) ?? [];
+  if (candidates.length !== 1)
+    return fail("Handler interface must select one unambiguous server transaction from {event, parameters} to unit");
+  return { source: fields.source.expectation, handler, operation: candidates[0]!.id };
+}
+
+/** Journals persist checked values, including managed references. They cannot
+ * persist process handles, opaque messages or edit commands. */
+export function journalPayloadType(type: ValueType): boolean {
+  switch (type.kind) {
+    case "scalar":
+    case "object-ref":
+      return true;
+    case "builtin":
+      return type.name === "unit";
+    case "list":
+    case "optional":
+      return journalPayloadType(type.value);
+    case "record":
+      return Object.values(type.fields).every(journalPayloadType);
+    case "variant":
+      return Object.values(type.cases).every((entry) => journalPayloadType(entry.value));
+    default:
+      return false;
+  }
+}
+export function journalPrimitiveSignature(
+  payload: ValueType,
+  primitive: JournalPrimitive,
+): Pick<InterfaceOperation, "mode" | "inputType" | "outputType"> {
+  const optional = (value: ValueType): ValueType => ({ kind: "optional", value });
+  if (primitive === "publish")
+    return {
+      mode: "call",
+      inputType: payload,
+      outputType: { kind: "record", fields: { publication: valueType.string } },
+    };
+  if (primitive === "head") return { mode: "call", inputType: valueType.unit, outputType: optional(valueType.uint64) };
+  return {
+    mode: "call",
+    inputType: { kind: "record", fields: { after: optional(valueType.string), limit: valueType.uint32 } },
+    outputType: {
+      kind: "record",
+      fields: {
+        entries: {
+          kind: "list",
+          value: { kind: "record", fields: { publication: valueType.string, position: valueType.uint64, payload } },
+        },
+        next: optional(valueType.string),
+        asOfHead: optional(valueType.uint64),
+      },
+    },
+  };
+}

src/capability-model/types.ts

@@ -196,7 +196,19 @@ export interface InterfaceRevision {
   argumentRequirements?: { target: ObjectExpectation; required: InterfaceRevisionId }[];
 }
 
-export type StoragePolicy = { kind: "register" } | { kind: "crdt-document"; updateType: ValueType };
+export interface JournalStorageLimits {
+  maxEntries: number;
+  maxBytes: number;
+  maxPublicationBytes: number;
+  maxProtectedSubscriptions: number;
+}
+export type StoragePolicy =
+  | { kind: "register" }
+  | { kind: "crdt-document"; updateType: ValueType }
+  | { kind: "journal"; limits: JournalStorageLimits }
+  | { kind: "subscription"; payload: ValueType };
+export type JournalPrimitive = "publish" | "readPage" | "head";
+export type SubscriptionPrimitive = "attach" | "status" | "pause" | "resume" | "retire";
 
 export interface StateSlotDefinition {
   kind: "state";
@@ -417,6 +429,8 @@ export interface RelationshipMaterialization {
 }
 
 export type Binding =
+  | { kind: "journal"; slotId: SlotId; primitive: JournalPrimitive }
+  | { kind: "subscription"; slotId: SlotId; primitive: SubscriptionPrimitive }
   | { kind: "lifecycle"; primitive: "delete" }
   | {
       kind: "interface";

src/capability-model/validation.ts

@@ -1,4 +1,10 @@
 import { isStorableType } from "./generics.js";
+import {
+  journalPayloadType,
+  journalPrimitiveSignature,
+  subscriptionContract,
+  subscriptionStatusType,
+} from "./journals.js";
 import { validateInitialization } from "./initialization.js";
 import { validatePresentations } from "./presentations.js";
 import { validateModules } from "./modules.js";
@@ -511,15 +517,32 @@ const atomSatisfiesConstraint = (
     ? constraint.atomId === atomId
     : conformances.has(conformanceKey(atomId, constraint.interfaceRevisionId));
 
+const interfaceImplies = (
+  indexes: ValidationIndexes,
+  actual: InterfaceRevisionId,
+  required: InterfaceRevisionId,
+  visited = new Set<string>(),
+): boolean => {
+  if (actual === required) return true;
+  if (visited.has(actual)) return false;
+  visited.add(actual);
+  return (indexes.interfaces.get(actual)?.revision.requiredInterfaces ?? []).some((entry) =>
+    interfaceImplies(indexes, entry, required, visited),
+  );
+};
+
 const constraintSatisfiesConstraint = (
   actual: EdgeEndpointConstraint,
   required: EdgeEndpointConstraint,
-  conformances: ReadonlyMap<string, Conformance>,
+  indexes: ValidationIndexes,
 ) =>
   constraintsEqual(actual, required) ||
   (actual.kind === "atom" &&
     required.kind === "interface" &&
-    atomSatisfiesConstraint(actual.atomId, required, conformances));
+    atomSatisfiesConstraint(actual.atomId, required, indexes.conformances)) ||
+  (actual.kind === "interface" &&
+    required.kind === "interface" &&
+    interfaceImplies(indexes, actual.interfaceRevisionId, required.interfaceRevisionId));
 
 const canAccessAttachment = (
   owner: AttachmentOwner,
@@ -858,24 +881,12 @@ const validateInterfaces = (
   issues: CapabilityValidationIssue[],
   indexes: ValidationIndexes,
 ) => {
-  const implies = (
-    actual: InterfaceRevisionId,
-    required: InterfaceRevisionId,
-    visited = new Set<string>(),
-  ): boolean => {
-    if (actual === required) return true;
-    if (visited.has(actual)) return false;
-    visited.add(actual);
-    return (indexes.interfaces.get(actual)?.revision.requiredInterfaces ?? []).some((entry) =>
-      implies(entry, required, visited),
-    );
-  };
   for (const [packageIndex, pkg] of workspace.packageImports.entries()) {
     for (const obligation of pkg.argumentRequirements ?? []) {
       const satisfied =
         obligation.target.kind === "atom"
           ? indexes.conformances.has(conformanceKey(obligation.target.atomId, obligation.required))
-          : implies(obligation.target.interfaceRevisionId, obligation.required);
+          : interfaceImplies(indexes, obligation.target.interfaceRevisionId, obligation.required);
       if (!satisfied)
         issue(
           issues,
@@ -890,7 +901,7 @@ const validateInterfaces = (
     for (const required of revision.requiredInterfaces ?? []) {
       if (!indexes.interfaces.has(required))
         issue(issues, "unresolved-reference", path, `Unknown prerequisite interface ${required}`);
-      else if (implies(required, revision.revisionId))
+      else if (interfaceImplies(indexes, required, revision.revisionId))
         issue(
           issues,
           "cyclic-conformance-requirement",
@@ -902,7 +913,7 @@ const validateInterfaces = (
       const satisfied =
         obligation.target.kind === "atom"
           ? indexes.conformances.has(conformanceKey(obligation.target.atomId, obligation.required))
-          : implies(obligation.target.interfaceRevisionId, obligation.required);
+          : interfaceImplies(indexes, obligation.target.interfaceRevisionId, obligation.required);
       if (!satisfied)
         issue(issues, "unsatisfied-interface", path, `Generic argument does not implement ${obligation.required}`);
     }
@@ -946,7 +957,8 @@ const validateAttachments = (issues: CapabilityValidationIssue[], indexes: Valid
         (type.kind === "variant" && Object.values(type.cases).some((entry) => containsRpcType(entry.value))) ||
         ((type.kind === "optional" || type.kind === "list") && containsRpcType(type.value));
       if (
-        containsRpcType(attachment.valueType) ||
+        (!["journal", "subscription"].includes(attachment.storagePolicy.kind) &&
+          containsRpcType(attachment.valueType)) ||
         (attachment.storagePolicy.kind === "crdt-document" && containsRpcType(attachment.storagePolicy.updateType))
       ) {
         issue(
@@ -959,6 +971,43 @@ const validateAttachments = (issues: CapabilityValidationIssue[], indexes: Valid
       if (attachment.storagePolicy.kind === "crdt-document") {
         validateValueType(issues, attachment.storagePolicy.updateType, `${path}.storagePolicy.updateType`, indexes);
       }
+      if (attachment.storagePolicy.kind === "journal") {
+        if (!journalPayloadType(attachment.valueType) || attachment.defaultValue !== undefined)
+          issue(issues, "invalid-attachment", path, "Journals require finite typed payloads and start empty");
+        const limits = attachment.storagePolicy.limits;
+        const ceilings = {
+          maxEntries: 10000,
+          maxBytes: 1048576,
+          maxPublicationBytes: 262144,
+          maxProtectedSubscriptions: 256,
+        };
+        if (
+          !limits ||
+          Object.keys(limits).length !== 4 ||
+          Object.entries(ceilings).some(
+            ([key, ceiling]) =>
+              !Number.isSafeInteger(limits[key as keyof typeof limits]) ||
+              limits[key as keyof typeof limits] < 1 ||
+              limits[key as keyof typeof limits] > ceiling,
+          ) ||
+          limits.maxPublicationBytes > limits.maxBytes
+        )
+          issue(issues, "invalid-attachment", path, "Invalid bounded journal limits");
+      }
+      if (attachment.storagePolicy.kind === "subscription") {
+        validateValueType(issues, attachment.storagePolicy.payload, `${path}.storagePolicy.payload`, indexes);
+        if (
+          !journalPayloadType(attachment.valueType) ||
+          !journalPayloadType(attachment.storagePolicy.payload) ||
+          attachment.defaultValue !== undefined
+        )
+          issue(
+            issues,
+            "invalid-attachment",
+            path,
+            "Subscriptions require finite typed payloads/parameters and start unattached",
+          );
+      }
       if (owner.kind === "conformance") {
         if (attachment.attachedTo !== owner.atomId) {
           issue(
@@ -1413,6 +1462,13 @@ const validateBoundDependencies = (
           break;
         }
         validateAttachmentAccess(issues, attachment, params.conformance, `${path}.binding.slotId`);
+        if (["journal", "subscription"].includes(attachment.attachment.storagePolicy.kind))
+          issue(
+            issues,
+            "invalid-dependency-binding",
+            path,
+            "Journal storage requires checked journal interface calls, not ordinary state ports",
+          );
         const traversal = stateBinding.via
           ? validateTraversal(
               issues,
@@ -1519,11 +1575,7 @@ const validateBoundDependencies = (
           );
         }
         if (
-          !constraintSatisfiesConstraint(
-            projection.target.constraint,
-            requirement.target,
-            params.indexes.conformances,
-          ) ||
+          !constraintSatisfiesConstraint(projection.target.constraint, requirement.target, params.indexes) ||
           requirement.cardinality !== projection.endpoint.cardinality ||
           requirement.keyType !== projection.endpoint.keyType
         ) {
@@ -1822,7 +1874,9 @@ const validateConformances = (
       ) {
         const native =
           member.kind === "value"
-            ? binding.kind === "state" && binding.primitive === "read"
+            ? (binding.kind === "state" && binding.primitive === "read") ||
+              (binding.kind === "journal" && binding.primitive === "head") ||
+              (binding.kind === "subscription" && binding.primitive === "status")
             : binding.kind === "edge" && binding.primitive === "resolve";
         if (!native && (member.queryRead.execution === "native" || binding.kind !== "package"))
           issue(
@@ -1878,6 +1932,67 @@ const validateConformances = (
           );
         continue;
       }
+      if (binding.kind === "journal") {
+        const attachment = findAttachment(indexes, "state", binding.slotId);
+        if (
+          !attachment ||
+          attachment.attachment.kind !== "state" ||
+          attachment.attachment.storagePolicy.kind !== "journal"
+        ) {
+          issue(issues, "invalid-state-binding", bindingPath, "Expected native journal storage");
+          continue;
+        }
+        validateAttachmentAccess(issues, attachment, conformance, bindingPath);
+        if (
+          attachment.attachment.attachedTo !== conformance.atomId ||
+          !["publish", "readPage", "head"].includes(binding.primitive) ||
+          !signaturesMatch(operation, journalPrimitiveSignature(attachment.attachment.valueType, binding.primitive))
+        )
+          issue(
+            issues,
+            "invalid-state-binding",
+            bindingPath,
+            "Journal primitive does not match this object operation's signature",
+          );
+        continue;
+      }
+      if (binding.kind === "subscription") {
+        const attachment = findAttachment(indexes, "state", binding.slotId);
+        if (
+          !attachment ||
+          attachment.attachment.kind !== "state" ||
+          attachment.attachment.storagePolicy.kind !== "subscription"
+        ) {
+          issue(issues, "invalid-state-binding", bindingPath, "Expected native subscription storage");
+          continue;
+        }
+        validateAttachmentAccess(issues, attachment, conformance, bindingPath);
+        const slot = attachment.attachment;
+        if (slot.storagePolicy.kind !== "subscription") continue;
+        if (slot.attachedTo !== conformance.atomId)
+          issue(issues, "invalid-state-binding", bindingPath, "Subscription belongs to another atom");
+        if (binding.primitive === "attach") {
+          try {
+            subscriptionContract(
+              slot.storagePolicy.payload,
+              slot.valueType,
+              operation,
+              [...indexes.interfaces.values()].map((value) => value.revision),
+            );
+          } catch (error) {
+            issue(issues, "invalid-state-binding", bindingPath, String(error));
+          }
+        } else if (
+          !["status", "pause", "resume", "retire"].includes(binding.primitive) ||
+          !signaturesMatch(operation, {
+            mode: "call",
+            inputType: valueType.unit,
+            outputType: binding.primitive === "status" ? subscriptionStatusType : valueType.unit,
+          })
+        )
+          issue(issues, "invalid-state-binding", bindingPath, "Subscription primitive signature mismatch");
+        continue;
+      }
       if (binding.kind === "state") {
         const attachment = findAttachment(indexes, "state", binding.slotId);
         if (!attachment || attachment.attachment.kind !== "state") {
@@ -1890,6 +2005,8 @@ const validateConformances = (
           continue;
         }
         validateAttachmentAccess(issues, attachment, conformance, `${bindingPath}.binding.slotId`);
+        if (["journal", "subscription"].includes(attachment.attachment.storagePolicy.kind))
+          issue(issues, "invalid-state-binding", bindingPath, "Use native journal primitives, not state access");
         if (attachment.attachment.attachedTo !== conformance.atomId) {
           issue(
             issues,
@@ -1990,11 +2107,7 @@ const validateConformances = (
             "Edge primitives may only implement relationship members",
           );
         } else if (
-          !constraintSatisfiesConstraint(
-            projection.target.constraint,
-            operationEntry.member.target,
-            indexes.conformances,
-          ) ||
+          !constraintSatisfiesConstraint(projection.target.constraint, operationEntry.member.target, indexes) ||
           operationEntry.member.cardinality !== projection.endpoint.cardinality ||
           (operationEntry.member.keyType !== undefined && operationEntry.member.keyType !== projection.endpoint.keyType)
         ) {
@@ -2002,7 +2115,7 @@ const validateConformances = (
             issues,
             "invalid-edge-binding",
             `${bindingPath}.binding`,
-            "Edge projection target or cardinality does not match relationship member",
+            `Edge projection target or cardinality does not match ${conformance.atomId}/${conformance.interfaceRevisionId}/${operationEntry.member.displayName}`,
           );
         }
         if (!signaturesMatch(operation, expected)) {
@@ -2531,7 +2644,7 @@ export const resolveOperationPlan = (
       attachment: owned as OwnedAttachment & { attachment: EdgeDefinition },
     };
   }
-  if (binding.kind === "lifecycle") return undefined; // Old runtime has no lifecycle provider.
+  if (binding.kind === "lifecycle" || binding.kind === "journal" || binding.kind === "subscription") return undefined; // These native providers require the current kernel.
   const packageRevision = plan.packages.get(binding.packageRevisionId);
   const packageExport = packageRevision?.exports.find(
     (entry): entry is PackageOperationExport | PackageFunctionExport =>
@@ -2679,7 +2792,7 @@ export const computeCapabilityClosure = (
         queued.push({ atomId: root.atomId, interfaceRevisionId: member.subject.interfaceRevisionId });
     }
     for (const binding of conformance.operationBindings.values()) {
-      if (binding.kind === "state") {
+      if (binding.kind === "state" || binding.kind === "journal" || binding.kind === "subscription") {
         attachments.add(binding.slotId);
       } else if (binding.kind === "edge") {
         attachments.add(binding.edgeTypeId);